ZebrocyMalware
- zekapab
According to brandefense, Zebrocy is malware that falls into the Trojan category, which the threat actor group APT28/Sofacy has used since 2015. Zebrocy malware consists of 3 main components; Backdoor, Downloader, and Dropper. The Downloader and Dropper take responsibility for discovery processes and downloading the main malware on the systems.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“HATVIBE runs from a scheduled task via mshta.exe and pulls further modules, reportedly leading to the CHERRYSPY backdoor.”
- T1056.001Keylogging
“The toolkit was unchanged: X-Agent for keylogging and screenshotting, X-Tunnel for exfiltration, Mimikatz for credential theft.”
- T1059.009Cloud API
“On the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2.”
- T1684Social Engineering
“The use of shapes is a quite common social engineering technique as it pushes the target to activate the macro in order to see the document’s content.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“From late 2015 onwards, APT28 introduced a parallel first-stage family named Zebrocy.”
-
Double-Tap: APT28-Linked Espionage on Kazakhstan“A potential overlap with APT28-related Zebrocy campaigns”
Indicators in its reports
named in the reports above- 35fee95e38e47d80b470ee1069dd5c9cin 1 report
- 06e4084e2d043f21…01a89e2a6deain 1 report
- 3b87dc25a11b6268…5d196f724997in 1 report
- 47092548660d5200…4736052bd7c3in 1 report
- 6edf3d03bd38c800…e57a52485e0cin 1 report
- c61e9326421d05d6…6a1fc275af19in 1 report
- e3a0be8852d77771…e44ef31713b9in 1 report
- e440bad60823642e…6eb107158b8din 1 report
- efc99e6f3cdd1031…17d61c7f0118in 1 report
- fd78051817b5e237…ae350ed6c889in 1 report
- 332d9db35daa83c5…b81e992bc725in 1 report
- 0fa7e3ffb8a9ca24…dfcefdddb0bein 1 report
- e8c0f309df515733…2b21a90cf05cin 1 report
- 51ca8b4aa5744148…8ff82c7de559in 1 report
- a502b51d44a3e2e59218618ab7a30971in 1 report
- 6f5a9ce100dd650dedbc3e68f74c3b97in 1 report
- e3f6d079d99eeb54566fc37fa24ff6f7in 1 report
- 78db9584ff4f7cd8f006eb6c12cac575in 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.